CVE-2016-2383

Published: 15 February 2016

The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.

From the Ubuntu Security Team

It was discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel did not correctly compute branch offsets for backward jumps after ctx expansion. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• http://www.openwall.com/lists/oss-security/2016/02/14/1
• https://ubuntu.com/security/notices/USN-2947-1
• https://ubuntu.com/security/notices/USN-2947-2
• https://ubuntu.com/security/notices/USN-2947-3
• https://www.cve.org/CVERecord?id=CVE-2016-2383
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1546173